PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Hidden Dangers of Crafting Your Own Regular Expressions for Input Validation

hackerone.com | blog | #denial-of-service | #web-security | #regex | #input-validation | #redos | #django
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Hand-written regular expressions for input validation can introduce false negatives and ReDoS; this post uses Django email validation examples to show the pitfalls and safer alternatives.
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
[CVE-2021-32763] Giới thiệu về kỹ thuật Regular Expression Denial of Service
Using CVE-2021-32763, a ReDoS in OpenProject, as a case study, the author explains regex denial of service through NFA/DFA theory and how evil regexes trigger catastrophic backtracking.
blog · hackerone.com
Breaking Down the OWASP Top 10: Insecure Design
HackerOne explains OWASP's Insecure Design category through CWEs like client-side enforcement of server-side security (CWE-602), showing how proxy tools such as Caido bypass client-side validation.
blog · hackerone.com
Implementing and Auditing HTTPS in Django: Best Practices
A practical guide to enforcing HTTPS in Django, covering security middleware settings for SSL redirects, HSTS with subdomains and preload, and other practices that harden TLS deployment.
blog · hackerone.com
Django Rest Framework vs. Django-Ninja: A High-Level Comparison
Compares Django Rest Framework and Django-Ninja: DRF brings mature flexibility with more boilerplate, while Ninja uses type hints and pydantic for faster, lighter, type-safe API development.
blog · hackerone.com
The Most Overlooked Server Permission Checks
From hundreds of backend code reviews: common authorization pitfalls in a Python/Django API, where trusting user-supplied IDs without real permission checks exposes users' private repositories.
blog · hackerone.com
How to Catch Injection Security Vulnerabilities in Code Review
XSS, SQL injection, and path control flaws stem from unvalidated input. The guide shows how to spot missing validation and sanitization during code review, where automated scanners often fall short.
Back